How to get a report of users whose password was expired over a specified number of days

Summary: This article contains step-by-step instructions on how to configure a report of users whose password was expired over a specified number of days.

Applies to: 7.x and later

ID: KB20210204-2

---

Configuration:

The example below shows how to configure a report of users whose password expired over 30 days ago.

1. In Admin Console click +New and create a new AD Users rule.
2. Specify Limit scope to this Domain or OU - select domain or OU.
3. Specify the following Query criteria using Query builder:
   

   {(PasswordNeverExpires -eq $False) -and (pwdLastSet -ne "0")}

   
4. Open the Other Query Settings section and specify the Filter:
   

   {$_."msDS-UserPasswordExpiryTimeComputed" -ne "0x7FFFFFFFFFFFFFFF" -and $_."msDS-UserPasswordExpiryTimeComputed" -ne $(0) -and $_."msDS-UserPasswordExpiryTimeComputed" -le $([DateTime]::Now.AddDays(-30).ToFileTime())}

   
5. In Properties to display add this expression to calculate Password Expiration Date:

   ,msDS-UserPasswordExpiryTimeComputed~Password Expiration Date~[datetime]::FromFileTime(`$_."msDS-UserPasswordExpiryTimeComputed")

6. Click Save Changes